FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Frameworks

Neos Flow

UnclassifiedOfficial website

Neos Flow is an open source PHP application framework maintained by the Neos team and used as the foundation for the Neos CMS and many custom enterprise applications. It is installed on the operator own infrastructure and provides building blocks such as routing, dependency injection, object persistence, and security. By default it only sets a session cookie that is strictly necessary to operate the application, which usually does not require consent.

Block Neos Flow until consentScan my site
Overview

What does Neos Flow do?

What Neos Flow is

Neos Flow is an open source PHP application framework that originated as the foundation of the Neos CMS and is now used to build a wide range of custom web applications. It offers conventions and components for routing, dependency injection, security, persistence, validation, and command line tooling. Because Flow is installed and operated on the controller own infrastructure, the maintainers do not receive any data from production deployments.

Cookies and data set by Neos Flow

By default Neos Flow only issues a session cookie used to keep server side state, for example to track an authenticated user or a multi step form. The framework does not bundle analytics, marketing, or fingerprinting code. Any additional cookie, third party script, or tracker is introduced by the developer team for the specific application built on Flow.

GDPR and ePrivacy implications

The default session cookie qualifies as strictly necessary under Article 5(3) of the ePrivacy Directive, which means it can be stored without prior consent. The legal basis under GDPR for related processing is typically legitimate interest or, when the user is logged in, performance of a contract. Personal data handled by the application built on Flow must be processed in line with the GDPR principles of lawfulness, purpose limitation, minimization, and integrity.

Consent requirements

No consent is required for the default session cookie. Consent does become necessary when developers add analytics, marketing, social embed, or A B testing modules. In that case the additional scripts must be blocked until the user opts in through a consent management platform.

International data transfers

Neos Flow is self hosted, so the location of the data is determined by the hosting provider chosen by the controller. There is no automatic transfer to the maintainers or to a SaaS backend. Controllers should make sure their hosting choice respects EU data residency requirements when relevant.

Practical compliance steps

Document the session cookie in the cookie policy as strictly necessary, configure secure cookie flags such as HttpOnly and SameSite, define realistic session lifetimes, log only what is needed, and review any third party module added to the application for its data protection impact before going live.

Compliance

Neos Flow and the GDPR

Legal basis
Legitimate interest (Article 6(1)(f) GDPR) for the session cookie strictly necessary to operate the application, no consent required for that purpose
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive

Impact assessment (DPIA)

Neos Flow itself does not perform any large scale processing, profiling, or tracking, so a DPIA is generally not required for the framework. A DPIA may be needed for the specific application built on top of Flow if it processes large volumes of personal data, special categories of data, or performs automated decision making. The assessment should focus on the application logic rather than on the framework.

Sample text for your banner

This application uses a session cookie required to keep you logged in and to operate the site. This cookie does not require your consent. If we add analytics or marketing cookies, we will ask for your consent separately in the cookie banner.
Cookies and trackers

What Neos Flow sets and contacts

Tracking method
Server side PHP framework with session cookies for stateful applications, no built in user tracking or analytics
Server location
Self hosted on the controller infrastructure, no managed service
Cookieless mode available
Yes

Cookies set (3)

NameTypeDurationPurpose
TYPO3_Flow_Sessionfirst_partySessionStores the server side session identifier required to keep the user logged in and maintain state across requests.
Neos_Sessionfirst_partySessionAlternative name used by some Flow based applications to store the technical session identifier.
flow_csrf_tokenfirst_partySessionStores the CSRF protection token used by Flow forms to prevent cross site request forgery.

Third-party domains contacted (3)

  • flow.neos.io
  • neos.io
  • packagist.org
Questions

Frequently asked questions about Neos Flow

Can't find your question? Write to us, we answer fast.

Which cookies does Neos Flow set?

Out of the box Neos Flow sets a single session cookie used to maintain server side state, typically for authentication or multi step workflows. It does not bundle analytics, marketing, or fingerprinting cookies.

Is consent required to use Neos Flow?

No consent is required for the default session cookie because it is strictly necessary under Article 5(3) of the ePrivacy Directive. Consent becomes necessary only if developers add analytics, marketing, or third party embeds to the application built on Flow.

What is the legal basis for processing?

The legal basis is legitimate interest under Article 6(1)(f) GDPR for the technical session and, when the user is logged in, performance of a contract under Article 6(1)(b). Other processing performed by the custom application must be assessed on its own merits.

Are data transferred to the United States?

No. Neos Flow is open source software installed on the operator own infrastructure and does not send data to the maintainers or to any third country by default. Transfers depend solely on the hosting choice made by the operator.

Is a DPIA needed for Neos Flow?

A DPIA is generally not required for the framework itself. It may be needed for the specific application built on Flow, depending on the categories of data processed, the scale, and the existence of profiling or automated decision making.

How to keep applications built on Flow compliant?

Use secure cookie flags, encrypt data at rest, limit retention, log only what is necessary, gate any added third party module behind consent, and document the processing activities in the records of processing.

Are there alternatives to Neos Flow?

Alternatives include Symfony, Laravel, Laminas, CodeIgniter, and Yii. The choice depends on team skills, ecosystem, and the specific architectural requirements of the application.

How to update the cookie policy for Neos Flow?

Add a clear entry stating that the application sets a session cookie as strictly necessary, that no analytics or marketing cookies are set by Flow itself, and that any additional cookie comes from custom modules or third party integrations.

Same category

More services: Frameworks

See the whole category

CreateJS

CreateJS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CreateJS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CreateJS helps organizations maintain robust websites that meet user expectations and technical requirements.

Frameworks

PhotoSwipe

PhotoSwipe is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. PhotoSwipe supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, PhotoSwipe ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Frameworks

Wized

Wized is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Wized supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Wized enables informed decisions that improve experience and drive results.

Frameworks

autoComplete.js

autoComplete.js is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. autoComplete.js supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, autoComplete.js ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Frameworks

Untree

Untree is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Untree supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Untree enables informed decisions that improve experience and drive results.

Frameworks

Magic UI

Magic UI is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Magic UI supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Magic UI ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Frameworks

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site